# Vulnerabilities published in 2026


- [CVE-2026-82537](https://insights.sbomify.com/CVE-2026-82537/): Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch (high 7.7)
- [CVE-2026-82536](https://insights.sbomify.com/CVE-2026-82536/): Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator (high 7.7)
- [CVE-2026-82535](https://insights.sbomify.com/CVE-2026-82535/): Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php (medium 5.3)
- [CVE-2026-82533](https://insights.sbomify.com/CVE-2026-82533/): DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing (critical 9.4)
- [CVE-2026-82531](https://insights.sbomify.com/CVE-2026-82531/): Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache (critical 9.2)
- [CVE-2026-82530](https://insights.sbomify.com/CVE-2026-82530/): IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header (medium 6.9)
- [CVE-2026-8253](https://insights.sbomify.com/CVE-2026-8253/): Devs Palace ERP Online purchase_save cross site scripting (medium 4.8)
- [CVE-2026-82527](https://insights.sbomify.com/CVE-2026-82527/): R2R 3.6.6 SQL Injection via Retrieval Search Filter Key (high 8.7)
- [CVE-2026-82526](https://insights.sbomify.com/CVE-2026-82526/): R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint (critical 9.3)
- [CVE-2026-82525](https://insights.sbomify.com/CVE-2026-82525/): Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing (medium 6.8)
- [CVE-2026-82524](https://insights.sbomify.com/CVE-2026-82524/): UnoPim File Upload RCE via TinyMCE Image Upload Endpoint (high 8.6)
- [CVE-2026-82522](https://insights.sbomify.com/CVE-2026-82522/): libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation (medium 5.3)
- [CVE-2026-82521](https://insights.sbomify.com/CVE-2026-82521/): parsedmarc 9.0.6 < 11.0.1 Path Traversal via Forensic Report Subject (medium 6.3)
- [CVE-2026-82520](https://insights.sbomify.com/CVE-2026-82520/): parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments (high 8.7)
- [CVE-2026-8252](https://insights.sbomify.com/CVE-2026-8252/): Open5GS SMF smf_nsmf_handle_create_data_in_hsmf null pointer dereference (medium 5.3)
- [CVE-2026-82519](https://insights.sbomify.com/CVE-2026-82519/): Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler (low 2.3)
- [CVE-2026-8251](https://insights.sbomify.com/CVE-2026-8251/): Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service (medium 5.3)
- [CVE-2026-8250](https://insights.sbomify.com/CVE-2026-8250/): Open5GS SMF n4-build.c smf_n4_build_qos_flow_to_modify_list denial of service (medium 5.3)
- [CVE-2026-8249](https://insights.sbomify.com/CVE-2026-8249/): Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service (medium 5.3)
- [CVE-2026-82488](https://insights.sbomify.com/CVE-2026-82488/): Beetel 450TC3 User Management cross site scripting (medium 5.1)
- [CVE-2026-82487](https://insights.sbomify.com/CVE-2026-82487/): Beetel 450TC3 password recovery (medium 5.3)
- [CVE-2026-82486](https://insights.sbomify.com/CVE-2026-82486/): SiteServer SSCMS Agent Installation Workflow access control (low 2.3)
- [CVE-2026-82485](https://insights.sbomify.com/CVE-2026-82485/): itsourcecode Sales and Inventory System pro_edit.php sql injection (medium 5.3)
- [CVE-2026-82484](https://insights.sbomify.com/CVE-2026-82484/): itsourcecode Sales and Inventory System emp_searchfrm.php sql injection (medium 5.3)
- [CVE-2026-82483](https://insights.sbomify.com/CVE-2026-82483/): coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting (medium 5.1)
- [CVE-2026-82482](https://insights.sbomify.com/CVE-2026-82482/): coppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting (medium 5.1)
- [CVE-2026-82481](https://insights.sbomify.com/CVE-2026-82481/): Path traversal in cohttp (high 8.7)
- [CVE-2026-82480](https://insights.sbomify.com/CVE-2026-82480/): NASA cFS cFE Software Bus cfe_sb_util.c CFE_SB_GetUserDataLength integer underflow (medium 5.3)
- [CVE-2026-8248](https://insights.sbomify.com/CVE-2026-8248/): Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service (medium 5.3)
- [CVE-2026-82479](https://insights.sbomify.com/CVE-2026-82479/): NASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflow (medium 5.3)
- [CVE-2026-82478](https://insights.sbomify.com/CVE-2026-82478/): NASA Trick TCP Socket JSONVariableServerThread.cpp parse_request stack-based overflow (medium 6.9)
- [CVE-2026-82477](https://insights.sbomify.com/CVE-2026-82477/): Server-side request forgery in Heimdall (medium 5.8)
- [CVE-2026-82476](https://insights.sbomify.com/CVE-2026-82476/): Memos through 0.30.0 SSRF via Omitted CGNAT Address Range (medium 6.9)
- [CVE-2026-82475](https://insights.sbomify.com/CVE-2026-82475/): iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check (high 8.6)
- [CVE-2026-82474](https://insights.sbomify.com/CVE-2026-82474/): Sudo through 1.9.17p2 Intercept Policy Bypass via execveat (high 8.5)
- [CVE-2026-82473](https://insights.sbomify.com/CVE-2026-82473/): KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints (high 8.8)
- [CVE-2026-82472](https://insights.sbomify.com/CVE-2026-82472/): Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf (high 8.7)
- [CVE-2026-82470](https://insights.sbomify.com/CVE-2026-82470/): Rodauth before 2.47.0 TOTP Code Reuse via Drift Window (medium 5.1)
- [CVE-2026-8247](https://insights.sbomify.com/CVE-2026-8247/): WatchGuard Firebox admd Out of Bounds Write Vulnerability (high 7.7)
- [CVE-2026-82469](https://insights.sbomify.com/CVE-2026-82469/): Rodauth before 2.47.0 Authentication Bypass via jwt_refresh (medium 5.1)
- [CVE-2026-82468](https://insights.sbomify.com/CVE-2026-82468/): Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type (medium 4.9)
- [CVE-2026-82467](https://insights.sbomify.com/CVE-2026-82467/): Rodauth before 2.47.0 Open Redirect via Return-to Path (medium 4.9)
- [CVE-2026-82466](https://insights.sbomify.com/CVE-2026-82466/): Rodauth before 2.46.0 Authentication Bypass via webauthn_login (critical 9.4)
- [CVE-2026-82465](https://insights.sbomify.com/CVE-2026-82465/): pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest (medium 6.9)
- [CVE-2026-82464](https://insights.sbomify.com/CVE-2026-82464/): pac4j-core before 6.5.6 Open Redirect via Backslash Logout (medium 5.3)
- [CVE-2026-82463](https://insights.sbomify.com/CVE-2026-82463/): pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check (high 8.6)
- [CVE-2026-82462](https://insights.sbomify.com/CVE-2026-82462/): pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution (medium 6.9)
- [CVE-2026-82461](https://insights.sbomify.com/CVE-2026-82461/): pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token (high 8.6)
- [CVE-2026-82460](https://insights.sbomify.com/CVE-2026-82460/): Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown (critical 9.3)
- [CVE-2026-82459](https://insights.sbomify.com/CVE-2026-82459/): Integer overflow in Apache Thrift (high 8.2)
- [CVE-2026-82458](https://insights.sbomify.com/CVE-2026-82458/): Denial of service in Apache Thrift (high 8.7)
- [CVE-2026-82457](https://insights.sbomify.com/CVE-2026-82457/): su-exec through 0.3 Privilege Escalation via Numeric User ID (high 8.5)
- [CVE-2026-82456](https://insights.sbomify.com/CVE-2026-82456/): argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP (critical 10.0)
- [CVE-2026-82454](https://insights.sbomify.com/CVE-2026-82454/): Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in (critical 9.3)
- [CVE-2026-82453](https://insights.sbomify.com/CVE-2026-82453/): rust-iot-platform Cleartext Password Storage via User Model (high 8.7)
- [CVE-2026-82452](https://insights.sbomify.com/CVE-2026-82452/): rust-iot-platform Authentication Bypass via Missing Request Guards (critical 9.3)
- [CVE-2026-82451](https://insights.sbomify.com/CVE-2026-82451/): Formwork < 2.3.11 Stored XSS via Referer Header (medium 5.3)
- [CVE-2026-82450](https://insights.sbomify.com/CVE-2026-82450/): BookStack before 26.05.4 Remote Code Execution via Book Cover (high 8.7)
- [CVE-2026-8245](https://insights.sbomify.com/CVE-2026-8245/): Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection (medium 6.0)
- [CVE-2026-82449](https://insights.sbomify.com/CVE-2026-82449/): Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing (medium 6.9)
- [CVE-2026-82448](https://insights.sbomify.com/CVE-2026-82448/): Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key (critical 9.3)
- [CVE-2026-82447](https://insights.sbomify.com/CVE-2026-82447/): Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock (high 8.7)
- [CVE-2026-82443](https://insights.sbomify.com/CVE-2026-82443/): Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) (critical 9.6)
- [CVE-2026-82441](https://insights.sbomify.com/CVE-2026-82441/): Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys (critical 9.1)
- [CVE-2026-8244](https://insights.sbomify.com/CVE-2026-8244/): Industrial Application Software IAS Canias ERP Login RMI improper authentication (medium 6.9)
- [CVE-2026-82439](https://insights.sbomify.com/CVE-2026-82439/): Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC (critical 9.8)
- [CVE-2026-82438](https://insights.sbomify.com/CVE-2026-82438/): Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins (high 8.1)
- [CVE-2026-82437](https://insights.sbomify.com/CVE-2026-82437/): Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer (medium 4.3)
- [CVE-2026-82435](https://insights.sbomify.com/CVE-2026-82435/): Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder (critical 9.8)
- [CVE-2026-82434](https://insights.sbomify.com/CVE-2026-82434/): Information disclosure in Apache Storm Client (critical 10.0)
- [CVE-2026-82433](https://insights.sbomify.com/CVE-2026-82433/): Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI (medium 6.5)
- [CVE-2026-82432](https://insights.sbomify.com/CVE-2026-82432/): Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides (high 8.1)
- [CVE-2026-82431](https://insights.sbomify.com/CVE-2026-82431/): Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users (critical 9.8)
- [CVE-2026-82430](https://insights.sbomify.com/CVE-2026-82430/): Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant (high 7.8)
- [CVE-2026-8243](https://insights.sbomify.com/CVE-2026-8243/): Industrial Application Software IAS Canias ERP JNLP Deployment Endpoint hard-coded key (medium 6.9)
- [CVE-2026-82429](https://insights.sbomify.com/CVE-2026-82429/): Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher (high 7.8)
- [CVE-2026-82428](https://insights.sbomify.com/CVE-2026-82428/): Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys (high 8.8)
- [CVE-2026-82427](https://insights.sbomify.com/CVE-2026-82427/): Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name (high 7.8)
- [CVE-2026-82426](https://insights.sbomify.com/CVE-2026-82426/): Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location (medium 6.5)
- [CVE-2026-82425](https://insights.sbomify.com/CVE-2026-82425/): Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service (not scored)
- [CVE-2026-82424](https://insights.sbomify.com/CVE-2026-82424/): PHPGurukul Student Information System student_edit1.php sql injection (medium 5.3)
- [CVE-2026-82423](https://insights.sbomify.com/CVE-2026-82423/): macrozheng mall Payment Status Endpoint paySuccess behavioral workflow (medium 5.3)
- [CVE-2026-82422](https://insights.sbomify.com/CVE-2026-82422/): itsourcecode Sales and Inventory System emp_del.php sql injection (medium 5.3)
- [CVE-2026-82421](https://insights.sbomify.com/CVE-2026-82421/): itsourcecode Sales and Inventory System emp_edit.php sql injection (medium 5.3)
- [CVE-2026-8242](https://insights.sbomify.com/CVE-2026-8242/): Industrial Application Software IAS Canias ERP Login RMI doAction response discrepancy (medium 6.3)
- [CVE-2026-82417](https://insights.sbomify.com/CVE-2026-82417/): qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property (medium 6.3)
- [CVE-2026-82416](https://insights.sbomify.com/CVE-2026-82416/): FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module (high 7.7)
- [CVE-2026-82412](https://insights.sbomify.com/CVE-2026-82412/): ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API (high 8.8)
- [CVE-2026-82411](https://insights.sbomify.com/CVE-2026-82411/): Objects API: Cross-object-type authorization bypass on the object history-detail endpoint (medium 6.5)
- [CVE-2026-82410](https://insights.sbomify.com/CVE-2026-82410/): Pocketbase: Unhandled panic in worker goroutines (high 8.7)
- [CVE-2026-8241](https://insights.sbomify.com/CVE-2026-8241/): Industrial Application Software IAS Canias ERP RMI iasGetServerInfoEvent improper authorization (medium 6.9)
- [CVE-2026-82409](https://insights.sbomify.com/CVE-2026-82409/): Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery (high 8.4)
- [CVE-2026-82407](https://insights.sbomify.com/CVE-2026-82407/): Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS (high 7.0)
- [CVE-2026-82406](https://insights.sbomify.com/CVE-2026-82406/): Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace (high 7.1)
- [CVE-2026-82405](https://insights.sbomify.com/CVE-2026-82405/): Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller (high 8.7)
- [CVE-2026-82404](https://insights.sbomify.com/CVE-2026-82404/): TOON: Prototype pollution when decoding untrusted TOON input (high 8.3)
- [CVE-2026-82402](https://insights.sbomify.com/CVE-2026-82402/): Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite` (medium 5.3)
- [CVE-2026-8240](https://insights.sbomify.com/CVE-2026-8240/): Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure in Backend\SummaryTemplate (medium 6.3)
- [CVE-2026-82399](https://insights.sbomify.com/CVE-2026-82399/): CoreDNS: Unauthenticated memory exhaustion in custom transports (high 7.5)
- [CVE-2026-82398](https://insights.sbomify.com/CVE-2026-82398/): pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/333/